Privacy Policy
Draft — the company registration details shown in [brackets] will be completed once the company's commercial registration is issued.
This policy explains what personal data Muqawil collects, why, on what legal basis, where it is stored, who receives it, how long we keep it, and how you can use your rights under the Saudi Personal Data Protection Law (PDPL) and its regulations. It applies to our website, the Muqawil web, mobile and desktop apps, and Muqawil Mail. If anything is unclear, write to privacy@muqawil.app.
At a glance: we use personal data only to provide, secure and bill the service and to meet legal duties. We do not sell personal data, show advertising or use advertising trackers. Our main database is in Frankfurt, Germany (European Union), so personal data is transferred outside the Kingdom under the safeguards in section 8. The data a company puts into its own Muqawil system (for example its workers' records) belongs to that company, and we process it only on its instructions. You can ask to see, copy, correct or delete your data at privacy@muqawil.app; we answer within 30 days. You can also complain to SDAIA.
1. Who we are
Muqawil (مقاول) is an online operations system for contracting companies in Saudi Arabia. It includes Muqawil ERP (app.muqawil.app and each company's own address), the Muqawil mobile apps for Android and iOS, the Muqawil desktop app for Windows, Muqawil Mail (mail.muqawil.app) and this website (muqawil.app). The service is provided by [LEGAL ENTITY NAME], a company registered in the Kingdom of Saudi Arabia under Commercial Registration No. [CR NUMBER], VAT registration No. [VAT NUMBER], registered address: [REGISTERED ADDRESS] ("Muqawil", "we", "us").
- Privacy questions and requests: privacy@muqawil.app
- Data Protection Officer: privacy@muqawil.app (write "For the Data Protection Officer" in the subject)
- General support: support@muqawil.app
- Postal address: [REGISTERED ADDRESS]
- Competent authority: the Saudi Data and Artificial Intelligence Authority (SDAIA), through the National Data Governance Platform: dgp.sdaia.gov.sa (main website: sdaia.gov.sa)
2. What this policy covers: our two roles
Muqawil is the controller of the personal data whose purpose and means we decide ourselves: website visitors, people who request access, the people who sign in to Muqawil as account holders (sign-in, security, billing and support data), users of @muqawil.app mail addresses, and people who contact us. This policy covers that data.
Muqawil is a processor of the data a customer company puts into its own Muqawil system ("Customer Data") — for example its employees and workers, attendance and payroll, site reports, clients, vendors, invoices, documents and the emails in its company mailboxes. The customer company is the controller of that data and decides why it is processed; we process it only on the company's documented instructions under our Data Processing Terms (muqawil.app/dpa). If you work for one of our customers and have a question about your data, please contact your employer first. If you write to us, we will pass your request to your employer and help them answer it.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Access request | Company name (English and Arabic), company code, CR and VAT number, city, number of employees, your name, email, mobile (WhatsApp), your message, the package you are interested in, referral code, and the version and time of the Terms and Privacy Policy you accepted | You, through the request form |
| Verification | A 6-digit code sent to your email (stored only as a one-way hash and valid for 15 minutes), your IP address and the result of the bot check | You and your browser |
| Account and sign-in | Name, email or username, company, role and permissions, password (stored only as a one-way hash), sign-in times, IP address, device and browser type, failed sign-in attempts | You, your company admin, your device |
| Employee self-service sign-in (when your employer turns it on) | Company code, iqama or national ID number used as your sign-in name, a PIN (stored only as a one-way hash), sign-in times and device type | Your employer and you |
| Mobile and desktop apps | Device model and operating system, app version, language, a push-notification token, crash information, and — only when you use the feature and allow it — photos you take and your location at that moment (see sections 5 and 6) | Your device |
| Billing | Package, subscription period, our tax invoices to your company, payment status and references. Card details are entered on our payment provider's secure page; we do not receive or store full card numbers | You, our payment provider |
| Support | Messages and tickets, screen-share or meeting sessions you start with our team, and records of support access to your system | You |
| Muqawil Mail | Mailbox address, name, title, signature, contacts, messages and attachments sent and received, folders and settings, and technical delivery data (sender and recipient addresses, sending servers, authentication and spam-check results) | You and the people who write to you |
| Security and audit logs | Who did what and when inside the system, errors and IP addresses | Our systems |
| Website and app preferences | Language, layout and similar choices saved on your device | Your browser or device |
| AI features (only if used) | The question or command you type or say, and the minimum context needed to answer it (see section 9) | You |
| Marketing preferences (only with consent) | Whether you agreed to receive news and offers, when and how, and your opt-out | You |
Fields marked with * on our forms are required: without them we cannot handle your request or open an account. Other fields are optional, and leaving them empty has no effect on the service.
4. Why we use personal data, and on what legal basis
| Purpose | Legal basis under the PDPL |
|---|---|
| Answering your access request, verifying your email, and setting up your trial and account | Your consent given on the form, and steps you ask for before entering into an agreement with us |
| Providing the service: sign-in, your company system, the apps, Muqawil Mail and support | The agreement your company has with us, to which you are a party as a user (PDPL Art. 6) |
| Keeping the service secure: bot protection, sign-in lockouts, audit logs, fraud and abuse prevention | Our legitimate interest in a safe service, assessed and documented as the Implementing Regulation requires (never used for sensitive data), and legal obligations |
| Billing, our tax invoices and our accounting records | Legal obligations (VAT and commercial books rules) and the agreement |
| Service messages: login details, security alerts, renewal reminders, invoices, changes to these documents | The agreement and legal obligations |
| News, offers and other marketing messages | Only your prior consent, given separately from these terms; you can withdraw it at any time (section 17) |
| Answering lawful requests from courts and competent authorities | Legal obligation |
We use personal data only for these purposes and keep only the minimum needed for them. We do not later use it for a purpose that does not fit the purpose for which it was collected unless the PDPL allows it, and if we want to use it for a new purpose we tell you first and, where required, ask for your consent. We do not sell personal data and we do not show advertising.
5. Sensitive data, identity numbers and location
- Biometric data: Muqawil does not collect or store fingerprint or face templates. Where a customer company connects an attendance device, the templates stay on that device and only the attendance record (employee number, time and device) is sent to Muqawil. If you unlock the app with Face ID or a fingerprint, this is handled by your phone's operating system and Muqawil receives no biometric data.
- Health data: a customer company may upload documents that contain health information (for example a sick-leave certificate). This is sensitive data under the PDPL; the company decides it is needed, and access to it is limited by the company's permissions.
- Iqama and national ID numbers are personal data that the PDPL protects, and Muqawil treats them with extra care: they are masked before any AI processing and shown only to users whose role needs them. Under PDPL Art. 28, copies of official identity documents may be kept only where a law requires it or a competent public authority asks for it; the customer company is responsible for that decision.
- Location: the apps read your location only at the moment you mark attendance or submit a site report, only while you are using the app, and only if you allow it. Muqawil does not track your location in the background or continuously. If you refuse location access, you can still use the app; the record is saved without a location.
6. App permissions
Our mobile and desktop apps ask for a permission only when you first use a feature that needs it. You can refuse or withdraw any permission at any time in your device settings, and the rest of the app keeps working.
| Permission | Why we ask | If you refuse |
|---|---|---|
| Camera | To take site photos, scan documents and receipts, or attach a photo to a record | You can pick an existing file instead, or skip the photo |
| Photos and files | To attach documents, receipts and pictures you choose | Nothing is attached |
| Location (only while using the app) | To stamp the place of an attendance mark or daily site report, when your company uses this feature | The record is saved without a location |
| Notifications | Approvals, payroll and attendance alerts, mail and security messages. We do not send advertising by push notification unless you opt in | You will not get alerts on your device; you still see them inside the app |
| Microphone | Only for spoken commands or meeting calls you start | Use typed commands; calls work without audio |
| Face ID / fingerprint unlock | Optional quick unlock, handled entirely by your device | Sign in with your password or PIN |
7. Who receives personal data
We use trusted service providers to run Muqawil. They process personal data only on our instructions, under data protection and confidentiality terms, and only as much as their service needs:
| Provider | What it does for us | Location |
|---|---|---|
| Supabase | Main database, sign-in (authentication), file storage, server functions and daily backups | Frankfurt, Germany (European Union) |
| Cloudflare | Hosting of the website and apps, security and bot protection (Turnstile), DNS, receiving and sending Muqawil Mail, storage of email attachments, and relay for screen-share and meeting calls | Cloudflare's global network |
| AI model provider (currently Anthropic, PBC) | AI features (Ask AI in the Help Center, the import assistant, typed or spoken commands) — only when you use them | United States |
| Transactional email provider (Resend or ZeptoMail by Zoho, when switched on) | Sending emails such as invoices to your clients and support replies | United States or the provider's other regions |
| Meta (WhatsApp Business) | WhatsApp messages — only when your company turns this channel on or you contact us on WhatsApp | Meta's global network |
| Moyasar | Card payments — only when online payment is switched on | Kingdom of Saudi Arabia |
| Apple and Google | Delivering push notifications to our mobile apps and distributing the apps through their stores | Global |
| Google (fonts and call connection) | The website font is loaded from Google, and Google's public server helps connect calls; your browser shares its IP address with Google | Global |
Other recipients: the Zakat, Tax and Customs Authority (ZATCA) receives the e-invoices that a customer company issues through Muqawil, because the law requires it; courts and competent authorities, only where the law requires and only the data requested; professional advisers bound by confidentiality; and a buyer or successor if Muqawil's business is transferred, with the same protections and with notice to you. A current list of the providers that process Customer Data is kept in the Data Processing Terms (muqawil.app/dpa).
8. Where data is stored, and transfers outside the Kingdom
Our main database and file storage are in Frankfurt, Germany (European Union). Some of the providers in section 7 operate outside the Kingdom. Storing or accessing personal data there is a transfer outside the Kingdom under Article 29 of the PDPL.
- Purpose: we transfer personal data only to provide the service you or your company asked for and to run the operations that service needs, as allowed by Article 29 of the PDPL and Article 2 of the Regulation on Personal Data Transfer outside the Kingdom.
- Minimum data: we send only the data the purpose needs. For example, identity numbers, IBANs and contact details are masked before any AI processing.
- Safeguards: where the Regulation requires it, we use the safeguards it sets out in Article 4, including the Standard Contractual Clauses issued by SDAIA, and we bind our providers to data protection terms.
- Risk assessment: we carry out and document the transfer risk assessment that Article 7 of the Regulation requires, following SDAIA's guideline, and repeat it when our providers or the law change.
- Protection: all transfers are encrypted in transit and data is encrypted at rest. We will stop a transfer if its safeguards stop working.
- Sensitive data: biometric templates are not transferred (section 5).
- Changes: if Saudi law requires personal data to be stored inside the Kingdom, or when we move our storage there, we will update this policy and inform customers before the change.
9. AI features
- Ask AI (Help Center): only your question and text from the Muqawil help manual are sent; no company data.
- Import assistant (only if your company switches it on): column headings and a few sample rows. Identity numbers, IBANs, phone numbers, emails and long numbers are masked before sending.
- Commands (typed or spoken): the command text and the minimum context needed to understand it, such as a name or a balance. Turning speech into text is done by your own browser or phone, under its maker's terms.
- Under its commercial terms, the AI model provider processes this data only to return an answer and does not use it to train its models.
- AI only suggests. A person always reviews and confirms before anything is saved. Muqawil does not make decisions about you based only on automated processing.
10. Muqawil Mail and the confidentiality of communications
Emails in Muqawil Mail are confidential. We do not read, analyse or use the content of your emails for any purpose of our own, and never for advertising. Our systems scan messages automatically only to deliver them, block spam and malware and protect accounts. Our team can see a mailbox only when the mailbox owner or the company admin gives a time-limited support code, or where Saudi law requires us to act. For company mailboxes, the customer company (through its mail admin) controls the mailboxes and their content.
11. How long we keep personal data
| Data | How long |
|---|---|
| Access requests that do not become customers | Up to 24 months after our last contact, then deleted |
| Email verification codes | 15 minutes; kept only as a one-way hash |
| Proof that you accepted our Terms and Privacy Policy, and proof of marketing consent | While the account exists and 5 years after it ends, to prove consent |
| Account and user profile data | While the subscription is active, then a 30-day export period, then deleted within 90 days (Terms of Service, section 14) |
| Muqawil's own tax invoices, payment records and accounting books | At least 10 years (Law of Commercial Books, Art. 8), and VAT records at least 6 years from the end of the tax period (VAT Implementing Regulations, Art. 66) |
| Support tickets and messages | Up to 3 years after the ticket is closed |
| Customer Data (employees, payroll, attendance, invoices, books, site reports, documents) | As the customer company decides while it subscribes; afterwards as set out in the Data Processing Terms. The company must keep its own copies for the periods the law sets for it (for example 6 years for VAT records, 15 years for real estate, 10 years for commercial books) |
| Muqawil Mail | While the mailbox exists. Messages stay until they are deleted; deleted attachments are removed from storage by an automatic clean-up |
| AI request logs | Up to 12 months |
| Security and audit logs | As long as needed for security and to show who did what, normally no longer than 24 months; financial audit trails as long as the records they protect |
| Backups | Daily backups are kept for up to 7 days, then overwritten |
| Our records of processing activities | While the processing continues and 5 years after it ends (Implementing Regulation, Art. 33) |
When personal data is no longer needed, we destroy it securely or make it anonymous so that it can no longer identify anyone, as Article 18 of the PDPL requires — unless a law requires us to keep it longer, or it is needed for a pending legal case.
12. How we protect data
- Encryption in transit (HTTPS/TLS) everywhere, and encryption at rest by our hosting providers.
- Each company's data is separated in the database by row-level security, so one company cannot read another company's data; this is checked with automated tests after every database change.
- Role-based permissions, maker-checker approvals for money entries, and audit logs of changes.
- Passwords and PINs are stored only as one-way hashes. Sign-in is locked after repeated wrong attempts. Our own console requires a second verification step.
- Bot protection and rate limits on public forms; monitoring of the service.
- Our team can see a customer's system only when the customer gives a time-limited support code. That access is read-only, ends automatically and is logged.
- Least-privilege access for our staff, confidentiality duties, and secrets kept outside the code.
- Daily backups.
No system is perfectly secure. If you think your account is at risk, change your password and write to support@muqawil.app straight away.
13. Personal data breaches
We investigate every security incident. If a breach affects personal data that we control, we notify SDAIA within 72 hours of becoming aware of it, as the Implementing Regulation requires, and we tell the people affected without undue delay where the breach may harm them, in simple language and with advice on how to protect themselves. If the breach affects Customer Data, we inform the customer company without undue delay so it can meet its own duties (see the Data Processing Terms). We keep a record of every breach and the steps we took.
14. Your rights
Under the PDPL you have the right to:
- Be informed about how and why your personal data is collected and processed (this policy).
- Access your personal data that we hold.
- Get a copy of your personal data in a clear, readable and commonly used electronic format.
- Ask us to correct, complete or update your personal data.
- Ask us to destroy personal data we no longer need, unless a law requires us to keep it.
- Withdraw your consent at any time where we rely on consent. This does not affect processing done before you withdrew it.
- Complain to the competent authority and, where the law allows, claim compensation for harm.
15. How to use your rights or complain
- Write to privacy@muqawil.app from the email address we know, or ask your company admin. We may ask you to confirm your identity before we act, and we log every request.
- We answer within 30 days. If a request needs unusual effort or you send several requests, we may extend this once by up to 30 more days and will tell you why before the first 30 days end.
- Using your rights is free. We may refuse a request that is clearly unfounded, repeated or excessive, and we will tell you why.
- If your data is held by your employer in its Muqawil system, we pass your request to your employer and help them answer it.
- If you are not satisfied with our answer, you can complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), through the National Data Governance Platform: dgp.sdaia.gov.sa (main website: sdaia.gov.sa). Under the Implementing Regulation, a complaint is normally made within 90 days of the incident or of when you became aware of it.
16. Deleting your account
You can ask us to delete your Muqawil account at any time, free of charge:
- In the Muqawil mobile apps (when available): open the account menu and choose "Delete my account".
- On the web: muqawil.app/delete-account — enter your account email, confirm with the code we send you, and send the request.
- By email: write to privacy@muqawil.app from your account email with the subject "Delete my account".
- If you cannot sign in: write to privacy@muqawil.app with your name, company and the email or phone on the account, and we will verify your identity.
What happens next: we confirm the request, then within 30 days delete your sign-in and profile data (name, email, phone, password or PIN, device tokens and preferences) and email you when it is done. Backups are overwritten within 7 days. We keep only what the law requires us to keep, such as tax invoices and accounting records (at least 6 years under the VAT rules of ZATCA) and proof of consent (section 11); in those records your personal data is removed or anonymised wherever the law does not require it.
If your account was created by your employer: the records your employer keeps about your work (for example attendance, payroll and end-of-service records) belong to your employer, which must keep some of them by law. Deleting your account removes your sign-in and profile; we tell your employer, and any request about those work records is handled by your employer. If you are the account holder of a company, deleting your account closes the whole company (you confirm by typing its name): it becomes read-only for 30 days so you can still view and export its data, and is then deleted within 90 days, as section 14 of the Terms of Service (muqawil.app/terms) describes. Admins who are not the account holder only delete their own login.
17. Marketing messages
We send news and offers by email, WhatsApp, SMS or push notification only if you have given your prior consent, separately from accepting our Terms. Every marketing message names Muqawil as the sender and includes a free and easy way to opt out, and we stop as soon as you ask. We keep proof of your consent and your opt-out. Service messages (such as sign-in codes, security alerts, invoices and renewal reminders) are not marketing and are sent as part of the service.
18. Cookies, local storage and the offline copy of the app
We do not use advertising or tracking cookies, and we do not use analytics or advertising tools on our website or in our apps.
| Where | What is saved on your device | Why |
|---|---|---|
| Website | Your language choice and a referral code (if you came from a referral link), in your browser's local storage | To remember your choice |
| Website | Cookies set by Cloudflare's security and bot-protection service | Strictly necessary for security |
| Apps and Mail | Your sign-in session, the accounts you signed in to on this device, and preferences such as language and layout, in local storage | Strictly necessary to keep you signed in and make the app work |
| Apps and Mail | An offline copy of the app's files (service worker cache) | So the app loads fast and keeps working on a weak connection |
Because these items are strictly necessary, they do not need consent. You can clear them in your browser or device settings at any time; you will then be signed out.
19. Children
Muqawil is a service for businesses. Muqawil accounts are for adults acting for a company, and we do not knowingly collect personal data from children. A customer company's own records may include young workers where Saudi labour law allows it; the company is responsible for that data and for any guardian consent the law requires. If you believe a child has given us personal data, write to privacy@muqawil.app and we will delete it.
20. Changes to this policy
When we change this policy, we publish the new version here with a new date and version number. If the change is important, we also tell customers by email or inside the app before it takes effect, and where a change needs your consent we will ask for it.
21. Language
This policy is published in Arabic and English. If there is any difference between them, the Arabic version prevails.
22. Contact
privacy@muqawil.app (privacy and Data Protection Officer) · support@muqawil.app · [LEGAL ENTITY NAME], Commercial Registration No. [CR NUMBER], [REGISTERED ADDRESS]
Khulasa (Roman Urdu): Muqawil aap ka data sirf service chalane, hifazat, billing aur qanooni zaroorat ke liye istemal karta hai — becha nahi jata, ishtihar nahi, tracker nahi. Data Frankfurt (Germany) me hai, is liye mulk se bahar transfer hai: SDAIA ke contract clauses + risk assessment ke sath. Face/fingerprint template Muqawil me nahi aate. Location sirf attendance/site report ke waqt, permission ke sath. Company ke workers ka data company ka hai; hum sirf company ki hidayat par kaam karte hain. Apna data dekhne, copy lene, durust karwane ya mitwane ke liye privacy@muqawil.app — 30 din me jawab. Account delete: muqawil.app/delete-account (email + code), ya isi email par (mobile app aane par app me "Delete my account" bhi); maali record (ZATCA) kam az kam 6 saal, shakhsi data hata kar / gumnaam. Shikayat SDAIA ko bhi.